Ivanti_CVE-2023-35078_2023.07.31

# lucene string "\/mifs\/aad\/api\/v2\/admins\/users"
#https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078
#CVE-2023-35078
#CVE-2023-35081

rule Ivanti_CVE-2023-35078
{
    meta:
        author = "spicy-bear"
        date = "2023-07-31"
        description = "Detect scanning for Ivanti CVE-2023-35078 vulnerabiliy"

    strings:
        $string = "\/mifs\/aad\/api\/v2\/admins\/users"

    condition:
        $string
}